The indent/move bar above the keyboard stayed after the keyboard was
closed (back button) because the bullet kept its focus, and covered the
bottom navigation. useKeyboardInset now reports keyboardOpen by
comparing the visible height with the height without keyboard, which
works whether the browser shrinks the page or only the visual viewport.
Release v0.27.1.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- The floating bullet actions only react to hover on devices with a real
pointer; a tap on a phone made the invisible buttons clickable.
- A bullet that is only a note link (plus hashtags) can no longer be
extracted: button and /extract are hidden, the server answers 400.
- Extract notice on phones sits above the bottom navigation, text on
top (two lines max) with the actions below.
- Release v0.26.1.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Desktop shows "offline" with a red dot under the user name when the
server is unreachable; phones show a green/red dot on the avatar.
Based on the app-wide realtime connection, so a server outage is
noticed even while the device has network (4 s grace period).
- Screenshots converted to WebP (1280 px desktop, 480 px phone, q90),
e2e/screenshots.sh converts with cwebp; new journal picture with
round corners. Rules in AGENTS.md.
- Release v0.26.0.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- /li lists /link first: name prefix, aliases, name, then description
- link cards about twice as tall; the bare address below becomes an accent
link marker; the link chip bar under bullets is gone, bare web addresses
in text are links themselves
chore(release): v0.14.3
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Fjord (new), Polarized Hell and Suri Hell complete the families
Klassik, Fjord, Terrakotta, Polarized, Suri
- settings: family table, follow-system, corners, button frames and an own
accent colour (per device); compact quick picker in the user menus
- code colours in index.css are fallbacks only
chore(release): v0.14.0
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- dark counterpart of Terrakotta; Soft users move to it
- add tailwindcss-animate: the existing animate-in/fade/slide classes now
run; menus zoom in, sheets slide up, notes slide in on phones
- no animations with reduced motion
chore(release): v0.13.0
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Bold, italic and strikethrough render their inside again, so **`code`**
shows bold code instead of backticks; inline code uses the theme's code
background with the main text colour instead of the accent colour.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- focus mode: folders slide in from the left (button, title click, or the
left edge on wide screens); picking a note keeps focus mode
- workspace bar: borderless live/shared/save pills in one style, divider
before the note actions; footer without top line
- journal panel and calendar open with an animation, the view fades in
- paste and markdown import nest a list under the paragraph introducing it
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
CI keeps the 'test once per code state' plan but records commit and
git tree as image labels instead of extra :sha-/:tree- tags, so the
registry only holds dev, latest, vX.Y.Z and stable; the plan test now
asserts the expected decisions.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- VAPID keys from VAPID_* or generated once (push_keys, migration 9);
devices in push_subscriptions, forgotten on 404/410 from the push service
- push column for every event (also due tasks) and the daily summary,
bundles as one notification; /push/key, /devices, /subscribe,
/unsubscribe, /test
- settings: switch push on per device, test it, see the devices; the
service worker shows notifications and focuses MindSift on click
- tests decrypt a sent push like a browser (RFC 8291) and check VAPID
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- copy a link to a bullet from its action bubble or pick a bullet in the
link dialog; [[Note#^id|Note › excerpt]] opens the note, jumps to and
highlights the bullet, or says it is gone
- wiki links render inline with their label and are clickable; the
duplicate chip below the text is gone
test(e2e): run each suite with its own container, image tag and port, so
parallel runs from another working copy no longer remove our server
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- the journal opens as a framed panel and closes on a second click,
returning to the previous note; journal state and the last regular note
survive tab switches, the fallback note is never a journal day
- pasted and imported markdown nests content under its heading (H2 below
H1), Enter on a heading creates a child, '- ' / '* ' / '+ ' start a bullet
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- block type 'numbered' (/number): 1., a., i. by nesting, continues on
Enter, an empty item ends the list; markdown export/import as 1.
- pasting: parser moved to lib/pasteOutline with tests; blank lines split
paragraphs, numbered lists keep their type, indentation levels follow
the widths in use (2, 3 or 4 spaces, tabs)
- text that stays in the focused block after pasting (a paragraph with
line breaks) was dropped; the block now takes it
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- journal_days (migration 8) maps a person's day to an ordinary note;
GET /journal lists the days, POST /journal/{date} opens or creates one
- the journal sits on top of the notes sidebar: days below each other
(today first, older ones load while scrolling), a calendar with month
and year picker follows the day in view and jumps to any day
- the header shares the day in view; journal notes stay out of the folder
tree; can be switched off per device under Darstellung
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- GET /link-preview?url= fetches the page on the server (https only,
SSRF-guarded like webhooks), reads Open Graph/Twitter tags, title,
description and icon from the head, loads picture and icon (no SVG) and
keeps them in link_previews (migration 6) for 7 days; readers' browsers
never contact the page. Off in the demo; 300 fetches per address in
15 minutes.
- Compact card above the bullet (icon, site, title, one line, small
picture); the duplicate link badge is left out.
- ✕ turns the address into [title](url), so hiding syncs with the note;
"Link-Vorschauen anzeigen" under appearance switches all off per device.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- /bild (only in an empty bullet) turns the bullet into an inline picker:
file, camera on phones, drag & drop, paste, or an https link the server
copies. Esc/✕ restores the empty bullet; nothing is synced before the
upload succeeded.
- Photos are shrunk to 2048 px and stored as WebP (JPEG fallback); the
re-encoding drops EXIF data such as the location.
- Image block: loaded with the login as blob URL, click opens full
screen, optional caption kept in the block content
().
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- New useVoiceInput hook (lib/voice.ts): "server" records with MediaRecorder
and sends to /voice/transcribe, "browser" keeps the live recognition,
"off" or missing browser support hides the microphone.
- Quick dump bar, mobile capture sheet and hold-to-record use it; live
waves from the real input level (VoiceWave) and "Wird erkannt…".
- Recordings stop after STT_MAX_SECONDS.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
safeHref lets only http, https and mailto become links (Markdown viewer,
outliner, legal links); javascript: and friends show as text. A
middleware sets a Content-Security-Policy (scripts only from MindSift,
no framing, connections only to this server), X-Frame-Options,
nosniff, Referrer-Policy and a Permissions-Policy. The two inline
scripts of index.html moved to files so script-src stays 'self'.
The second inline script also deleted every cache on each page load,
which undermined the offline start; it is gone.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Covers opening and closing the task dialog (the former hook-order bug),
date/time fields and the view-only mode for viewer lists, the avatar
stack of shared items, the two-tap delete in the trash, scope selection
and badges of API keys, and the shared password rule.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
WebSocket and EventSource put the 30-day session token into the URL,
where proxies log it. The app now gets a one-time ticket right before
connecting (POST /auth/stream-ticket, 60 s, bound to the token version);
?token= is no longer accepted for streams, non-browser clients may use
the Authorization header.
With BASE_URL set, CORS allows only that origin and WebSocket upgrades
only it or the requested host; credentials are off (no cookies exist).
Logout, ending all sessions, a new password and deactivation close all
live streams of the account; clients with a valid session reconnect
with a fresh ticket.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The service worker now caches the app shell: page loads are network
first with the last index.html as fallback, hashed bundles come from the
cache, icons and manifest are refreshed in the background; API calls are
never intercepted. GET answers are kept per user in IndexedDB and served
when the server cannot be reached, so the app starts logged in with the
last known thoughts, tasks and lists. Captured thoughts and checked tasks
or list items go to an outbox that is sent in order when the connection
returns (also at start and every 30 s). A banner shows offline state and
waiting changes. Logging out clears cache and outbox.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Due dates can carry a time (YYYY-MM-DDTHH:MM). Alarms fire at that time,
or 09:00 for all-day tasks, minus the user's lead time, in TZ (default
Europe/Berlin, tzdata embedded). A new due date or reopening a task
re-arms the alarm. Recurrence keeps the time; Markdown export/import
carry it. The UI shows relative labels ("Heute, 14:30"), marks overdue
tasks to the minute and groups by local day instead of the UTC date.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- FormSheet: create dialogs (task list, shopping list, folder) as bottom
sheet right above the on-screen keyboard (visualViewport), large fields;
centred or anchored dialog on desktop
- Emoji picker: category icons keep their sprite size (no doubled icons,
round highlight), one 'Zuletzt verwendet' (library category, German
names), sheet and picker height follow the keyboard
- Mobile header no longer repeats the current section next to the logo
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Theme manager in settings: upload a .css file or paste CSS, template
download/copy/insert, edit and delete; custom themes show up in the
gallery and the quick switchers
- Themes are injected live as <style id="mindsift-custom-theme">; the
active one is cached so it applies on boot without flashing
- Backend: user_themes table and GET/POST /themes, DELETE /themes/{id}
(per user, max 200 KB)
- Docs: theming, REST, database
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Mobile
- Plus button in triage did nothing: the stored action returned the
capture function instead of calling it
- Workspace: tabs share the full width; save status sits as an icon next
to the note title instead of wrapping into its own row; "Neue Notiz" /
"Neuer Ordner" only in the top menu (and +), not repeated in the list
- Outliner fields measured while hidden stayed one line high (cut-off
callout); they are measured again when their width changes
- Task dialog: scrolls in a div instead of a fieldset, height in dvh,
notes editor grows with its text, so long notes are fully reachable
Desktop
- Delete button of the selected task/shopping list sits inside the tab as
its own rounded button (matches rounded themes like Soft)
Both
- Tasks sometimes did not open: every reload after an action replaced the
list with a loading placeholder, swallowing clicks; reloads are now
silent after the first load of a list, stale responses are dropped
- Hashtags need whitespace or "(" before "#", so URL anchors are no
longer tags (server, browser); one-time cleanup of stored anchor tags
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Phase 4 of the collaboration plan:
- The sync engine listens for DOC_SEQ in the note's realtime room and syncs
right away. Without WebSocket/SSE it long-polls /docs/{id}/changes (25 s);
after three failures it falls back to polling every 3 s and retries long
polling when the browser comes back online.
- With push or long polling the engine only syncs every 7 s while holding
leases (renewal), otherwise every 30 s as a safety net. Focusing a block
announces its lease immediately (otherwise it could take up to 30 s).
- Realtime connection: SSE counts as connected only after its first event;
a stream that stays silent for 5 s (buffering proxy) switches SSE off for
the tab. App-level PING/PONG detects WebSockets that are accepted but
forward nothing and switches to SSE after 35 s.
- The editor shows the active channel for shared notes.
- Tests: engine channel tests (push, heartbeat, lease on focus, long
polling, interval fallback, switching), realtime fallback tests with fake
WebSocket/EventSource, Go tests for PONG and DOC_SEQ delivery, and
e2e/channels.e2e.mjs measuring latency behind six simulated proxy setups
(0.2-0.3 s on all live channels, ~3 s with plain polling).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
